diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-01-15 20:33:17 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-01-15 20:36:24 +0000 |
| commit | 18a60a034abd3862ea28451f94cf2d3c7bb25307 (patch) | |
| tree | 8c3e28e509f1ff19bc4d8bec574b09bcc5f38274 /sw | |
| parent | e50b785b5eeb7a3f3deedf1125c205d6abec8ac3 (diff) | |
crashtesting: fix a badzillion writer layout crashes
e.g. fdo80788-1.odt
Invalid read of size 2
at 0x3C031438: SwLinePortion::IsParaPortion() const (porlin.hxx:132)
by 0x3C05EC56: SwTextFormatter::BuildPortions(SwTextFormatInfo&) (itrform2.cxx:679)
by 0x3C05F2A2: SwTextFormatter::FormatLine(int) (itrform2.cxx:1550)
Address 0x3576189e is 30 bytes inside a block of size 40 free'd
at 0x4C2ED4A: free (vg_replace_malloc.c:530)
by 0x4E56939: rtl_freeMemory_SYSTEM(void*) (alloc_global.cxx:279)
by 0x4E56978: rtl_freeMemory (alloc_global.cxx:349)
by 0x4E5501B: rtl_cache_free (alloc_cache.cxx:1230)
by 0xDACE741: FixedMemPool::Free(void*) (mempool.cxx:49)
by 0x3C043AB8: SwTextPortion::operator delete(void*, unsigned long) (portxt.hxx:55)
by 0x3C043B05: SwHangingPortion::~SwHangingPortion() (porrst.hxx:98)
by 0x3C043F47: std::default_delete<SwHangingPortion>::operator()(SwHangingPortion*) const (unique_ptr.h:76)
by 0x3C044070: std::unique_ptr<SwHangingPortion, std::default_delete<SwHangingPortion> >::reset(SwHangingPortion*) (unique_ptr.h:344)
by 0x3C0888C3: std::unique_ptr<SwHangingPortion, std::default_delete<SwHangingPortion> >::operator=(decltype(nullptr)) (unique_ptr.h:280)
by 0x3C0888DB: SwTextGuess::ClearHangingPortion() (guess.hxx:51)
since...
commit a706bb06d5326e7a997dd1d71f3f947bd0ad28e6
Date: Wed Jan 11 14:26:47 2017 +0200
new loplugin: useuniqueptr: sw part 1
Change-Id: I614029474d684ddcccd4f4a5e9787fe6c19d8fd2
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/core/text/guess.hxx | 2 | ||||
| -rw-r--r-- | sw/source/core/text/portxt.cxx | 3 |
2 files changed, 2 insertions, 3 deletions
diff --git a/sw/source/core/text/guess.hxx b/sw/source/core/text/guess.hxx index 9fd797dba05d..feea8afaeab0 100644 --- a/sw/source/core/text/guess.hxx +++ b/sw/source/core/text/guess.hxx @@ -48,7 +48,7 @@ public: bool AlternativeSpelling( const SwTextFormatInfo &rInf, const sal_Int32 nPos ); SwHangingPortion* GetHangingPortion() const { return pHanging.get(); } - void ClearHangingPortion() { pHanging = nullptr; } + SwHangingPortion* ReleaseHangingPortion() { return pHanging.release(); } sal_uInt16 BreakWidth() const { return nBreakWidth; } sal_Int32 CutPos() const { return nCutPos; } sal_Int32 BreakStart() const { return nBreakStart; } diff --git a/sw/source/core/text/portxt.cxx b/sw/source/core/text/portxt.cxx index 2c200c09eec0..bd32236324b7 100644 --- a/sw/source/core/text/portxt.cxx +++ b/sw/source/core/text/portxt.cxx @@ -340,9 +340,8 @@ bool SwTextPortion::Format_( SwTextFormatInfo &rInf ) { Width( aGuess.BreakWidth() ); SetLen( aGuess.BreakPos() - rInf.GetIdx() ); - Insert( aGuess.GetHangingPortion() ); aGuess.GetHangingPortion()->SetAscent( GetAscent() ); - aGuess.ClearHangingPortion(); + Insert( aGuess.ReleaseHangingPortion() ); } // breakPos >= index else if ( aGuess.BreakPos() >= rInf.GetIdx() && aGuess.BreakPos() != COMPLETE_STRING ) |